Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbfe82814966f306…

MALICIOUS

PDF

47.4 KB Authoring application: OpenOffice Draw
MD5: b94e050bac729ea002d4d022f8cc76de SHA-1: 74087690496024d8140647314188ff3f1070f36f SHA-256: fbfe82814966f3065419376f85ab92e32be2ad7a746c8797f0cf32d57335198e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly suggest malicious intent. No scripts were extracted from this sample, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://made-in-water.com/uploads/1/3/0/6/130621749/5225992.pdf
    • http://nerieconst.com/uploads/1/3/0/6/130640020/1daeeb44eb3.pdf
    • http://aprendizajeactivobrumiel.com/uploads/1/3/0/6/130604074/2560908.pdf
    • http://www.100wwclickingcounty.org/uploads/1/3/0/6/130621682/d0332007b.pdf
    • http://jordankuzmanovski.com/uploads/1/3/0/6/130639307/8152975.pdf
    • http://ps360x.org/uploads/1/3/0/5/130590373/05114d33e6.pdf
    • http://magic.kameronmessmer.com/uploads/1/3/0/5/130551898/kanuso.pdf
    • http://kaptivateinc.com/uploads/1/3/0/3/130313809/a09d803f.pdf
    • http://folkturk.net/uploads/1/3/0/4/130436127/0fa991919e.pdf
    • http://bakehouseonline.com/uploads/1/3/0/6/130605173/3c383079e.pdf
    • http://castillocoin.com/uploads/1/3/0/4/130494389/wepodamu_golede_rozajudadexupa.pdf
    • http://kitchencounsel.net/uploads/1/3/0/5/130544190/a51c0b00c0c9.pdf
    • http://paralleltech.net/uploads/1/3/0/7/130775196/8057188.pdf
    • http://dustbuster.us/uploads/1/3/0/8/130814469/gosuxozivuwurivu.pdf
    • http://bijoumoscow.com/uploads/1/3/0/6/130604133/2416667.pdf
    • http://deannaheon.com/uploads/1/3/0/5/130538836/501da.pdf
    • http://underworldofus.com/uploads/1/3/0/4/130436431/medenekar-vaworuza-sodon.pdf
    • http://herbalhealingformulacream.com/uploads/1/3/0/3/130313500/zawuwekapi.pdf
    • http://siam-edu.net/uploads/1/3/0/7/130775431/9133407.pdf
    • http://motors-auto.com/uploads/1/3/0/4/130435982/fifar.pdf
    • http://suderve.com/uploads/1/3/0/8/130814310/3dd1b4.pdf
    • http://millerhahn-wedding.rominastiebenphotography.com/uploads/1/3/0/6/130603688/130603688.html#alanine+aminotransferase+%28alt%29+low

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003a02.bin
4d9ec2aec8f1ca6bebe1b56492fd55a77bba3a6e98efb76508c1b835d4eb9912		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A02 2860 bytes
font_01_sfnt_off00004373.bin
42fec308b7cab2f393414e9bdc1a6bd25b4aa0b9070acde390e3b63ffb91afd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4373 16100 bytes
font_02_sfnt_off00005ab3.bin
043f38c918c53b3be190a416faac992ba790b049e48b9cbf6bd2ae9a10aea18c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5AB3 7332 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.